Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3392
glib2 and ibus security and bug fix update
30 September 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: glib2 and ibus
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-14822 CVE-2019-12450
Reference: ESB-2020.2593
ESB-2020.1523
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:3978
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: glib2 and ibus security and bug fix update
Advisory ID: RHSA-2020:3978-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3978
Issue date: 2020-09-29
CVE Names: CVE-2019-12450 CVE-2019-14822
=====================================================================
1. Summary:
An update for glib2 and ibus is now available for Red Hat Enterprise Linux
7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64
3. Description:
GLib provides the core application building blocks for libraries and
applications written in C. It provides the core object system used in
GNOME, the main loop implementation, and a large set of utility functions
for strings and common data structures.
The Intelligent Input Bus (IBus) is an input method framework for
multilingual input in Unix-like operating systems.
Security Fix(es):
* glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly
restrict file permissions while a copy operation is in progress
(CVE-2019-12450)
* ibus: missing authorization allows local attacker to access the input bus
of another user (CVE-2019-14822)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.9 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1717958 - CVE-2019-14822 ibus: missing authorization allows local attacker to
access the input bus of another user
1719141 - CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib
does not properly restrict file permissions while a copy operation is in progress
1777221 - IBUS input methods don't work in QT5-based applications
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
glib2-2.56.1-7.el7.src.rpm
ibus-1.5.17-11.el7.src.rpm
noarch:
ibus-setup-1.5.17-11.el7.noarch.rpm
x86_64:
glib2-2.56.1-7.el7.i686.rpm
glib2-2.56.1-7.el7.x86_64.rpm
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
ibus-1.5.17-11.el7.i686.rpm
ibus-1.5.17-11.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-gtk2-1.5.17-11.el7.i686.rpm
ibus-gtk2-1.5.17-11.el7.x86_64.rpm
ibus-gtk3-1.5.17-11.el7.i686.rpm
ibus-gtk3-1.5.17-11.el7.x86_64.rpm
ibus-libs-1.5.17-11.el7.i686.rpm
ibus-libs-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch:
glib2-doc-2.56.1-7.el7.noarch.rpm
ibus-devel-docs-1.5.17-11.el7.noarch.rpm
ibus-pygtk2-1.5.17-11.el7.noarch.rpm
x86_64:
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-devel-2.56.1-7.el7.i686.rpm
glib2-devel-2.56.1-7.el7.x86_64.rpm
glib2-fam-2.56.1-7.el7.x86_64.rpm
glib2-static-2.56.1-7.el7.i686.rpm
glib2-static-2.56.1-7.el7.x86_64.rpm
glib2-tests-2.56.1-7.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-devel-1.5.17-11.el7.i686.rpm
ibus-devel-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
glib2-2.56.1-7.el7.src.rpm
x86_64:
glib2-2.56.1-7.el7.i686.rpm
glib2-2.56.1-7.el7.x86_64.rpm
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
Source:
ibus-1.5.17-11.el7.src.rpm
noarch:
glib2-doc-2.56.1-7.el7.noarch.rpm
ibus-devel-docs-1.5.17-11.el7.noarch.rpm
ibus-pygtk2-1.5.17-11.el7.noarch.rpm
ibus-setup-1.5.17-11.el7.noarch.rpm
x86_64:
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-devel-2.56.1-7.el7.i686.rpm
glib2-devel-2.56.1-7.el7.x86_64.rpm
glib2-fam-2.56.1-7.el7.x86_64.rpm
glib2-static-2.56.1-7.el7.i686.rpm
glib2-static-2.56.1-7.el7.x86_64.rpm
glib2-tests-2.56.1-7.el7.x86_64.rpm
ibus-1.5.17-11.el7.i686.rpm
ibus-1.5.17-11.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-devel-1.5.17-11.el7.i686.rpm
ibus-devel-1.5.17-11.el7.x86_64.rpm
ibus-gtk2-1.5.17-11.el7.i686.rpm
ibus-gtk2-1.5.17-11.el7.x86_64.rpm
ibus-gtk3-1.5.17-11.el7.i686.rpm
ibus-gtk3-1.5.17-11.el7.x86_64.rpm
ibus-libs-1.5.17-11.el7.i686.rpm
ibus-libs-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
glib2-2.56.1-7.el7.src.rpm
ibus-1.5.17-11.el7.src.rpm
noarch:
ibus-setup-1.5.17-11.el7.noarch.rpm
ppc64:
glib2-2.56.1-7.el7.ppc.rpm
glib2-2.56.1-7.el7.ppc64.rpm
glib2-debuginfo-2.56.1-7.el7.ppc.rpm
glib2-debuginfo-2.56.1-7.el7.ppc64.rpm
glib2-devel-2.56.1-7.el7.ppc.rpm
glib2-devel-2.56.1-7.el7.ppc64.rpm
ibus-1.5.17-11.el7.ppc.rpm
ibus-1.5.17-11.el7.ppc64.rpm
ibus-debuginfo-1.5.17-11.el7.ppc.rpm
ibus-debuginfo-1.5.17-11.el7.ppc64.rpm
ibus-gtk2-1.5.17-11.el7.ppc.rpm
ibus-gtk2-1.5.17-11.el7.ppc64.rpm
ibus-gtk3-1.5.17-11.el7.ppc.rpm
ibus-gtk3-1.5.17-11.el7.ppc64.rpm
ibus-libs-1.5.17-11.el7.ppc.rpm
ibus-libs-1.5.17-11.el7.ppc64.rpm
ppc64le:
glib2-2.56.1-7.el7.ppc64le.rpm
glib2-debuginfo-2.56.1-7.el7.ppc64le.rpm
glib2-devel-2.56.1-7.el7.ppc64le.rpm
ibus-1.5.17-11.el7.ppc64le.rpm
ibus-debuginfo-1.5.17-11.el7.ppc64le.rpm
ibus-gtk2-1.5.17-11.el7.ppc64le.rpm
ibus-gtk3-1.5.17-11.el7.ppc64le.rpm
ibus-libs-1.5.17-11.el7.ppc64le.rpm
s390x:
glib2-2.56.1-7.el7.s390.rpm
glib2-2.56.1-7.el7.s390x.rpm
glib2-debuginfo-2.56.1-7.el7.s390.rpm
glib2-debuginfo-2.56.1-7.el7.s390x.rpm
glib2-devel-2.56.1-7.el7.s390.rpm
glib2-devel-2.56.1-7.el7.s390x.rpm
ibus-1.5.17-11.el7.s390.rpm
ibus-1.5.17-11.el7.s390x.rpm
ibus-debuginfo-1.5.17-11.el7.s390.rpm
ibus-debuginfo-1.5.17-11.el7.s390x.rpm
ibus-gtk2-1.5.17-11.el7.s390.rpm
ibus-gtk2-1.5.17-11.el7.s390x.rpm
ibus-gtk3-1.5.17-11.el7.s390.rpm
ibus-gtk3-1.5.17-11.el7.s390x.rpm
ibus-libs-1.5.17-11.el7.s390.rpm
ibus-libs-1.5.17-11.el7.s390x.rpm
x86_64:
glib2-2.56.1-7.el7.i686.rpm
glib2-2.56.1-7.el7.x86_64.rpm
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-devel-2.56.1-7.el7.i686.rpm
glib2-devel-2.56.1-7.el7.x86_64.rpm
ibus-1.5.17-11.el7.i686.rpm
ibus-1.5.17-11.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-gtk2-1.5.17-11.el7.i686.rpm
ibus-gtk2-1.5.17-11.el7.x86_64.rpm
ibus-gtk3-1.5.17-11.el7.i686.rpm
ibus-gtk3-1.5.17-11.el7.x86_64.rpm
ibus-libs-1.5.17-11.el7.i686.rpm
ibus-libs-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
noarch:
glib2-doc-2.56.1-7.el7.noarch.rpm
ibus-devel-docs-1.5.17-11.el7.noarch.rpm
ibus-pygtk2-1.5.17-11.el7.noarch.rpm
ppc64:
glib2-debuginfo-2.56.1-7.el7.ppc.rpm
glib2-debuginfo-2.56.1-7.el7.ppc64.rpm
glib2-fam-2.56.1-7.el7.ppc64.rpm
glib2-static-2.56.1-7.el7.ppc.rpm
glib2-static-2.56.1-7.el7.ppc64.rpm
glib2-tests-2.56.1-7.el7.ppc64.rpm
ibus-debuginfo-1.5.17-11.el7.ppc.rpm
ibus-debuginfo-1.5.17-11.el7.ppc64.rpm
ibus-devel-1.5.17-11.el7.ppc.rpm
ibus-devel-1.5.17-11.el7.ppc64.rpm
ppc64le:
glib2-debuginfo-2.56.1-7.el7.ppc64le.rpm
glib2-fam-2.56.1-7.el7.ppc64le.rpm
glib2-static-2.56.1-7.el7.ppc64le.rpm
glib2-tests-2.56.1-7.el7.ppc64le.rpm
ibus-debuginfo-1.5.17-11.el7.ppc64le.rpm
ibus-devel-1.5.17-11.el7.ppc64le.rpm
s390x:
glib2-debuginfo-2.56.1-7.el7.s390.rpm
glib2-debuginfo-2.56.1-7.el7.s390x.rpm
glib2-fam-2.56.1-7.el7.s390x.rpm
glib2-static-2.56.1-7.el7.s390.rpm
glib2-static-2.56.1-7.el7.s390x.rpm
glib2-tests-2.56.1-7.el7.s390x.rpm
ibus-debuginfo-1.5.17-11.el7.s390.rpm
ibus-debuginfo-1.5.17-11.el7.s390x.rpm
ibus-devel-1.5.17-11.el7.s390.rpm
ibus-devel-1.5.17-11.el7.s390x.rpm
x86_64:
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-fam-2.56.1-7.el7.x86_64.rpm
glib2-static-2.56.1-7.el7.i686.rpm
glib2-static-2.56.1-7.el7.x86_64.rpm
glib2-tests-2.56.1-7.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-devel-1.5.17-11.el7.i686.rpm
ibus-devel-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
glib2-2.56.1-7.el7.src.rpm
ibus-1.5.17-11.el7.src.rpm
noarch:
ibus-setup-1.5.17-11.el7.noarch.rpm
x86_64:
glib2-2.56.1-7.el7.i686.rpm
glib2-2.56.1-7.el7.x86_64.rpm
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-devel-2.56.1-7.el7.i686.rpm
glib2-devel-2.56.1-7.el7.x86_64.rpm
ibus-1.5.17-11.el7.i686.rpm
ibus-1.5.17-11.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-gtk2-1.5.17-11.el7.i686.rpm
ibus-gtk2-1.5.17-11.el7.x86_64.rpm
ibus-gtk3-1.5.17-11.el7.i686.rpm
ibus-gtk3-1.5.17-11.el7.x86_64.rpm
ibus-libs-1.5.17-11.el7.i686.rpm
ibus-libs-1.5.17-11.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
noarch:
glib2-doc-2.56.1-7.el7.noarch.rpm
ibus-devel-docs-1.5.17-11.el7.noarch.rpm
ibus-pygtk2-1.5.17-11.el7.noarch.rpm
x86_64:
glib2-debuginfo-2.56.1-7.el7.i686.rpm
glib2-debuginfo-2.56.1-7.el7.x86_64.rpm
glib2-fam-2.56.1-7.el7.x86_64.rpm
glib2-static-2.56.1-7.el7.i686.rpm
glib2-static-2.56.1-7.el7.x86_64.rpm
glib2-tests-2.56.1-7.el7.x86_64.rpm
ibus-debuginfo-1.5.17-11.el7.i686.rpm
ibus-debuginfo-1.5.17-11.el7.x86_64.rpm
ibus-devel-1.5.17-11.el7.i686.rpm
ibus-devel-1.5.17-11.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-12450
https://access.redhat.com/security/cve/CVE-2019-14822
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX3OjWtzjgjWX9erEAQiOZA/7BZzcl1v/sSYMlDoh+hjiiZVbG1zgsHap
zvvLLCGXnLfcGz/juCvCGmm5726bfAK1cv84sOSfVtZSLsW2mFfUv+ldr4ROMizh
O45gD1tJZrLkmMoGXNY/34gXBurEDvXqNyLcU0NYPZ8gfUS51nq0rM9X2j7uCJ0p
52J7wp/HuiWG14D6WPG8kFPuIN0Xqn50IK0xFh56X62lE/MCQlfmRPLByXETY256
UZp2VVEDsWVynZoSIwFQxtaHO7HeXAXzJAvaMhdhTFDKt+dxXroha1jT7QiaBqs6
/FJ8fTlUIZ8Cs7O8vzDly32lTOQFi1fcUQeKE75AhUoc5h/to3PBsrvTKnzu264j
ePx8/QfplUgaelmHQ9aBc/8sgJdBUTIv16EBKLAnwMQDnxTgWXR9CrpUI+/u9Jt+
RQmpqaGC9cxJK2PEVkzB08LMIMznvcX/wa3JXVrg8fau5Z1Dkd8ybqRszY265K+P
ajoMTV0fljUKwEu17SjA1ZwKAabxZ5llieoxDMJY3OMMMPs/PYaNSpfbS4XafPFF
iOfhSFvLYORRLeS+/K59BuVid0Wo9YqoLN+PzJsDXrYebjb64simo518NfYvRiGw
KeXBBXo5B4SkQulB9Z2nAaOIBZ2Odh5Q9cQjiNOagej/ZXHAoQO7AiVpm00KJc0t
R5JpPMyDh90=
=/RCK
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX3QSMuNLKJtyKPYoAQidKA/9EJ6kBVii3NAnotFKg0TNdAwlAh/mzZIl
DXa32/x3jKFS3oQfSeIzcdcOsLD3RoSgR0YkrSAftLEq+NhiIhIuEZTPU7YI3SN/
CYpXae2YqGZcldoYVl79Olw3NiZgnItNFcpxa4VIUxa45nv8i6oV5lVwGLP/ccVO
vUmjnCJLRrjY3bTeYgcKuY5QgOAZdssnp5YQQBmg+3BZ1BiseQFRWsU2qfDrSc/S
5ID3q5lqXfdUN+ZmhNdXu1nY3P22e3wqt/uzDWHI6kGHYl/dJ95UNEKTeQv63nFh
KqRjCtfHQZxE8Y/2Zx93bfHUYLACBK1Hfxa9n+XpNno2XNBHCEWMm/QVVImHOitP
7eAz1JeYs0sEtZsAiWwLYb0WWPSztD93neDpr6pWk8wMcojUUEbYbSYSiPAp2at1
tLlSv8mICf9Ry3/FRRDdt36YiWSJPRT6SCz2URVTXvsNRFrFLvAx7elVlPd6wm3j
weatJmjmmqa1WCxrk8d5wMDhkP58h4UgSZtwcRMdaSxWkHUhvT+Ot3gX9qG44ULX
HFsIZnEQuqaFjn1+ndvp2AduPGTxQ8WeqWJpaCgT2nC0EEoKc4sIPsZyOi0ro78C
DWebTKAbRa44VzUt2y1nghWWaHpe2FR4EljRMfvd+C1F8EyrlgK3jHXc0hWloARB
jGTe5HTiyI8=
=ETsN
-----END PGP SIGNATURE-----